Last updated: October 19, 2026.

This Privacy Policy explains how 18092516 Canada Inc. o/a CarcoCRM ("CarcoCRM", "we", "us", or "our") collects, uses, discloses, and protects personal information. We are committed to handling personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Scope and our role

This policy covers personal information we handle as an organization: visitors to our websites, prospects, and the dealership staff who hold CarcoCRM accounts. When a dealership uses CarcoCRM to manage its own customers and inventory, the dealership is the controller of that customer information and CarcoCRM acts as its service provider (processor). Our handling of that customer information is governed by our Data Processing Agreement and the dealership's own privacy practices.

2. Information we collect

Account and contact information you provide when you request a demo, start a trial, or open an account, such as your name, business name, email address, phone number, province, and role.
Usage information generated when you use our websites and product, such as pages viewed, features used, device and browser type, and approximate location derived from your IP address.
Cookies and similar technologies, as described in our Cookie Policy.
Communications you send us, including support requests and messages.

3. How we use personal information

To provide, maintain, secure, and improve our websites and the CarcoCRM product.
To set up accounts, process trials and subscriptions, and provide support.
To communicate with you about your account, service updates, and, where permitted, news about products and features. You can opt out of marketing messages at any time.
To understand how our websites are used and to measure marketing performance.
To detect, prevent, and respond to fraud, abuse, and security incidents.
To meet legal and regulatory obligations.

4. Consent and legal basis

We collect, use, and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and the purpose. By providing information or using our services, you consent to the practices described here. You may withdraw consent at any time, subject to legal and contractual limits, by contacting us. We will explain the consequences of withdrawal where relevant.

5. Cookies and analytics

We use cookies and similar technologies for essential site functions, analytics, and advertising measurement. For details and choices, see our Cookie Policy.

6. Service providers and disclosure

We share personal information with service providers who process it on our behalf to run our business, such as hosting, communications, analytics, and infrastructure providers. These providers are bound by contract to protect the information and use it only for the services they provide to us. Our current infrastructure service providers are listed on our Subprocessors page.

Our artificial intelligence features are provided by Carco Technologies and run on our own private infrastructure. We do not send customer or personal information to any third-party artificial intelligence provider.

We may also disclose personal information where required or permitted by law, to protect our rights and the safety of others, or in connection with a business transaction such as a financing, merger, or sale, subject to appropriate safeguards.

7. Phone calls, recordings and transcripts

CarcoCRM lets a dealership make and receive phone calls on its business numbers. When it does, we handle the call information on the dealership's behalf, as its service provider. The dealership decides whether its calls are recorded and whether callers hear a recording notice.

What we process. For every call: the phone numbers involved, the date, time and length of the call, how it was answered or routed, and which staff member handled it. If the dealership has turned on call recording, we also keep the audio of the call. If a caller leaves a voicemail, we keep the message.

Transcripts and call notes. We turn recorded calls into written transcripts. We may also produce short notes about a call, such as a summary, commitments made during the call, and a suggested follow-up task. A staff member decides whether to act on a suggestion. These features are provided by Carco Technologies and run on our own private infrastructure. Recordings and transcripts are not sent to any third-party artificial intelligence provider.

Why. So the dealership can keep an accurate record of what was discussed, follow up on what a caller asked for, and train and coach its staff.

Who can access them. Access to recordings and transcripts is limited by role within the dealership's account.

Where they are stored. Our telephone carrier, Twilio, makes the recording. We copy it to private, access-controlled storage operated by Cloudflare in North America and to our own servers, and then delete Twilio's copy.

How long we keep them.

Recordings, voicemails and transcripts are deleted automatically 12 months after the call. Notes made from a transcript are deleted with it.
A dealership may keep a specific call longer while it is needed for a dispute, a complaint or a legal matter, and then releases it to the normal schedule.
A dealership may delete a recording sooner, for example when a caller asks, unless the call is on hold. This removes the audio, any voicemail, the transcript and the notes together, and cannot be undone.
The record that a call took place (the numbers, date, time and length) stays with the dealership's business records after the recording is deleted.
Deleted recordings and transcripts can remain in our encrypted backups for up to about seven months, until those backups expire. Backups are not used in day-to-day operation.

If you called a dealership. The dealership is responsible for your information. Ask the dealership about a recording of your call, or ask it to delete one. You can also contact us using the details below and we will pass your request to the dealership.

8. Where your information is stored

We host the CarcoCRM product and its primary data in Canada. Some service providers may process limited information (for example, message delivery, content delivery, or analytics) in other countries. Where that happens, the information remains subject to this policy and to contractual protections, and it may be accessible to courts, law enforcement, and regulatory authorities in those jurisdictions.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and least-privilege practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Retention

We keep personal information only as long as needed for the purposes described here, to meet legal, accounting, or reporting requirements, and to resolve disputes and enforce our agreements. We then delete or de-identify it. Call recordings, voicemails and transcripts follow the specific periods in section 7.

11. Your privacy rights

Subject to applicable law, you may request access to the personal information we hold about you, ask us to correct it if it is inaccurate, and ask questions about our handling of it. To make a request, contact our Privacy Officer using the details below. We may need to verify your identity before responding.

12. Children

Our websites and product are intended for businesses and are not directed to children. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the date above and, where appropriate, provide additional notice. Your continued use of our websites and product after an update means you accept the revised policy.

14. Contact us

To reach our Privacy Officer or ask a question about this policy, email hello@carcocrm.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Our registered office is at 3-1124 Stellar Dr, Newmarket, ON L3Y 7B7, Canada.